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Abstract 

Enhanced engine operation — operation that is beyond normal limits — has the potential to improve the 
adaptability and safety of aircraft in emergency situations. Intelligent use of enhanced engine operation to 
improve the handling qualities of the aircraft requires sophisticated risk estimation techniques and a risk 
management system that spans the flight and propulsion controllers. In this paper, an architecture that 
weighs the risks of the emergency and of possible engine performance enhancements to reduce overall 
risk to the aircraft is described. Two examples of emergency situations are presented to demonstrate the 
interaction between the flight and propulsion controllers to facilitate the enhanced operation. 

1.0 Introduction 

In emergency situations, aircraft engines can be used as actuators to improve the capability and 
controllability of the aircraft. There are several examples of pilots using this technique in an attempt to 
recover and land a severely impaired aircraft. In 1972, an American Airlines DC-10 landed safely in 
Detroit after suffering damage that resulted in a stuck, offset rudder as well as partial elevator loss; 1 the 
pilot used asymmetric thrust to maintain heading. 2 In the 1985 JAL 123 accident, the Boeing 747 lost all 
hydraulics as well as suffering severe vertical tail loss, which excited the dutch roll (coupled yaw and roll 
oscillations) and phugoid (long period pitch oscillations) modes. The pilots used asymmetric thrust to 
regain limited directional control but ultimately failed to recover and crashed with tremendous loss of 
life. 3 In the 1989 DC-10 accident in Sioux City, Iowa, the plane lost hydraulic power to all flight control 
surfaces, and there was some tail damage. Here, the phugoid was much more of a problem than the dutch 
roll, and the crew was able to maintain enough control through modulation of engine thrust to crash land 
the aircraft and save a majority of the passengers. 4 In 2003, a DHL cargo plane climbing out of Baghdad 
was hit by a missile, causing loss of all hydraulics and wing damage. The pilots were able to successfully 
return to the airport and land using only the throttles to control the aircraft. 
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In the aftermath of the Sioux City accident, NASA began investigating the use of throttles-only flight 
control. Several airframe configurations were studied, and it was found that the severity of the dutch roll 
and phugoid modes depends on multiple factors, but in general the engine response is too sluggish to be 
used to damp out the dutch roll, and the administration of thrust pulses to damp dutch roll may actually 
exacerbate it. 5 As the above examples demonstrate, use of the engines to modulate the aircraft’s dynamic 
behavior can improve the chance of survival in an emergency; however, the engine response may need to 
be improved to fully realize this benefit. 

In this paper we consider two specific emergency scenarios: vertical tail damage and runway 
incursion. Damage to the vertical tail can be detrimental in two ways. First, a reduction in the area of the 
vertical tail will reduce the directional stability of the aircraft. Second, if the rudder is disabled, the main 
control surface used for active yaw damping is lost. In the event of vertical tail damage, the dutch roll 
mode, which involves coupled yaw and roll oscillations, becomes much harder to control and in the worst 
case may be unstable. The dutch roll is often the least stable lateral-directional mode, and many planes 
rely on an automatic yaw damper to keep it manageable. One way to help recover directional stability is 
to use differential engine thrust to produce yawing moments. However, flight tests and simulator studies 
have shown that landing a plane safely using only engine thrust is extremely difficult, in part because 
engine response times, which are on the order of seconds, are much slower than conventional flight 
control surfaces. 6 This is problematic because the dutch roll period is also on the order of seconds. For 
this reason, controlling the dutch roll with engine thrust is difficult and can even be counterproductive, 
possibly resulting in pilot induced oscillations that exacerbate the situation. 6 

Engine response time to a throttle input can be improved by modifying the engine controller. Such a 
modification carries risk, however, because it might cause a compressor stall. A throttle transient produces a 
temporary drop in compressor stall margin, and the amount of this drop increases (i.e., the stall margin is 
further reduced) if the acceleration of the engine is increased to improve response time. The stall margin 
cannot be directly measured, but in normal operation engine acceleration is conservatively limited to 
provide positive stall margin even in worst-case circumstances (end-of-life engine, high inlet distortion, 
etc.). If the engine acceleration is pushed faster than normal, the risk of compressor stall increases. 

The second emergency scenario we consider is runway incursion. Several serious accidents or near- 
accidents have resulted when pilots mistakenly attempted to take off on a runway that is too short or when 
an obstacle was present on the runway during takeoff. 7 ' 8 The ability to command more than the nominal 
maximum thrust (overthrust) in emergencies, pushing the engines beyond their normal safety limits, 
might enable pilots to avert such disasters by shortening the runway distance required for takeoff. 

In this paper we present an architecture for an on-line intelligent system for managing multiple sources 
of risk to an aircraft. The structure proposed is a general one that is able to balance the risk of exceeding 
engine limits with the risk of the emergency situation. Examples of the risk management architecture’s 
application to both the vertical tail damage case and the runway incursion case are presented. Finally the 
challenges that future work presents are discussed. 

2.0 Risk Management Architecture 

The risk management architecture 9 shown in Figure 1 consists of the flight and propulsion control 
systems and the interactions between them. Components of the architecture compute the risk to the engine 
of operating in an enhanced control mode, and in conjunction with the flight control, determine which 
propulsion control mode to implement based on the type of emergency and the severity of the situation. 
Looking at Figure 1, the Engine Operability Risk Models block estimates the increased risk due to engine 
stall to achieve a faster-than-normal engine response; this enhanced propulsion control mode can be used 
for yaw control. The Engine Life Prognosis Models block estimates the increased risk of engine failure 
due to operating the engine beyond its normal maximum for a given time; this enhanced propulsion 
control mode can be used to provide additional thrust to avoid an object on the runway. 
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Figure 1. — Risk management architecture. 


2.1 Balancing Risks 

During an emergency situation it may be acceptable to assume a reasonable additional risk of engine 
failure in order to safely land or control the distressed aircraft. The question is how to balance the risk that 
enhanced operation poses to the engine against the risk that the emergency situation poses to the plane. 
The goal is to maximize the probability that the plane is able to land safely. 

The two risks (to the engine and to the aircraft) are modeled as independent probabilities and 
combined to get a total probability of failure for the mission. Only two outcomes are recognized for the 
engine: it will either perform as desired or not. Aggressive use will significantly increase the probability 
of damage or stall; in either case, the engine will not be able to fulfill its mission. Even if the engine 
suffers a relatively mild, recoverable compressor stall, its unavailability at a critical moment coidd be 
disastrous. Therefore, the engine risk is modeled as a continuous function valued from essentially zero for 
normal operation up to one for extremely aggressive operation, representing the probability that the 
engine will not be able to perform as desired. That is, as the desired performance becomes more 
demanding, the probability of failure increases. 

The situational risk is a continuous function based on a model of airframe recovery and landing, 
representing the likelihood that the passengers can be saved given the situation and an assumed engine 
performance. After the Sioux City accident, the National Transportation Safety Board conducted 
simulator studies and concluded that the crippled aircraft “could not have been successfully landed on a 
runway with the loss of all hydraulic flight controls,” and that “under the circumstances the UAL flight 
crew performance . . . greatly exceeded reasonable expectations.” 4 This underscores that a spectrum of 
success can be identified. The probability of achieving some level of success depends on many factors 
including the level of uncertainty in the pilot’s awareness of the situation, variation in pilot skill, and 
weather conditions; the combination of these enables the situational risk to be defined. 
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In the presence of these competing risks, the optimal action is the engine response that results in the 
highest probability of overall success. The probability of success is the probability that the engine does 
not fail multiplied by the probability that the plane lands relatively safely. The total probability of failure 
should be minimized. If risk is the probability of failure (1 minus the probability of success), then the 
quantitative relationship between engine risk, R engine , situational risk, R„ tLi;ilion , and total risk, R tota i, is 
defined as follows. 

Rtotai 1 — ( 1 — Rengine) x ( 1 — Rsituation) 

Both of these are functions of the capability of the engine: engine risk is higher when the engine is pushed 
to respond faster, but situational risk is lower because the plane can better respond to the emergency. This 
inverse relationship is shown in Figure 2. Combining the two sources of risk in this way gives the overall 
risk to the plane as a function of the capability of the engine, which can be used to determine the optimal 
level of enhancement to request from the engine. 

Casting the problem of balancing risk as a minimization problem is useful because it is a simple 
process that is straightforward to generalize. For instance, consider a plane that has four engines and each 
has a different risk model. In this case, the problem is to decide on the appropriate enhancement 
commands to send to each of the engines. The situational risk model will take as inputs the capabilities of 
each of the four engines. The overall problem becomes the minimization of the total risk on the multi- 
dimensional domain of all possible engine enhancement configurations. 

2.2 Risk Communication Model 

The process of risk estimation and minimization is accomplished via cooperation between the engine 
controller and the flight controller. The engine controller possesses a risk model that gives the relationship 
between engine risk and engine capability. The flight controller possesses a risk model that gives the 
relationship between situational risk and engine capability. Since the propulsion system is being used as a 
flight control actuator, the flight controller is the one “in charge.” In appropriate emergency situations, the 
flight controller initiates a process in which it queries the engine controller to obtain the engine risk vs. 
capability model and combines that with its situational risk model to determine the optimal level of 
engine enhancement. It then delivers the enhancement command to the engine controller, which 
implements the enhancement. This process might run once or repeatedly, depending on the nature of the 
emergency and changing circumstances. The relationships between the three risks and engine capability 
are shown in Figure 2. 
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2.3 Engine Risk 

Knowledge of the relationship between engine risk and engine performance is necessary to minimize 
the total risk. Such a relationship is very complex as it relies on many variables including operating 
conditions, size of throttle transients, and engine degradation. For the overthrust case, using the engine 
beyond its designed maximum speed and temperature can severely shorten its life, and it significantly 
increases the risk of turbine blade liberation or disk burst. For fast response, the engine has a greatly 
increased likelihood of stalling. The controller is designed to maintain engine operation within bounds so 
that, under normal circumstances, the engine life and operability are predictable and safe. Once these 
bounds are exceeded through the use of an enhanced operation mode, there is greater uncertainty, and the 
risk is significantly increased. Any failure that prevents the engine from performing as desired can be 
catastrophic in an emergency. 10 

2.4 Situational Risk 
2.4.1 Vertical Tail Damage 

Damage to the vertical tail has a significant impact on the aircraft’s ability to damp out dutch roll. 

This has the effect of driving the flight dynamics toward instability, making the plane potentially much 
harder to land. We estimate a quantitative probability that a plane can land safely based on observed 
relationships between Cooper-Harper ratings of flying qualities 11 and objective quantitative information 
about the handling of the aircraft. Several studies have investigated the effect of the natural frequency and 
damping ratio of the dutch roll oscillation on flying qualities ratings. 121314 They have found useful 
correlations between Cooper-Harper ratings and the damping ratio, natural frequency, and roll-to-sideslip 
ratio of the dutch roll. These studies provide a basis for an automatic quantitative assessment of the risk of 
landing in a given aircraft configuration. Any analysis of the controllability of the aircraft makes an 
assumption about the vehicle’s dynamic behavior, which is influenced by not only the damage, the extent 
of which might not be known, but the flight condition. 

We construct an example of an automatic risk assessment of the dutch roll oscillation based on flying 
qualities specifications for military aircraft, found in the handbook MIL-HDBK-1797. This document sets 
three minimum requirements: one on the natural frequency, one on the damping ratio, and one on the 
product of the two, which can be modified depending on the roll-to-sideslip ratio of the oscillation. 15 
Additionally, MIL-HDBK-1797 specifies three “levels” of flying qualities: Level 1, “satisfactory,” Level 
2, “acceptable,” and Level 3, “controllable.” Level 3 is “not necessarily defined as safe.” It is assumed 
that an aircraft that satisfies the military Level 2 requirements for the dutch roll will be safe to land. This 
gives a region in the parameter space of flying qualities that carries 0% risk. On the other hand, it is 
assumed that an aircraft with a dutch roll natural frequency of zero or damping ratio of zero cannot be 
landed safely. The dutch roll natural frequency is related to the sideforce due to the sideslip term. A dutch 
roll natural frequency of zero would represent an aircraft with no tendency to automatically correct 
sideslips, and so it would be very difficult to maintain heading accurately enough to land. Zero damping 
would mean that dutch roll oscillations, once excited, would have no natural tendency to decrease with 
time, and these constant oscillations would again make landing very difficult. A negative damping ratio 
would be even worse, corresponding to exponentially growing oscillations. This region in the parameter 
space carries 100% risk. 

In the region between 0% and 1 00% risk, interpolation is used to estimate the risk for marginal 
configurations. Denoting dutch roll damping ratio by C and natural frequency (in rad/s) by co, the 
interpolation is defined piecewise in the c^-co plane. The risk interpolation function is defined piecewise on 
three regions, corresponding to the three minimum requirements. Risk is represented as a probability of 
mission failure between 0 and 1 . The risk estimation function is given below. 

The military requirements for Level 2 flying qualities are 

C, > A and co > B and C,co>C 
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with the values A = 0.02, B = 0.4, C = 0.05 for a transport aircraft with sufficiently low dutch roll roll-to- 
sideslip ratio in the landing phase of flight. In terms of these values, risk is estimated in various numbered 
regions of the ^-co plane (shown in Figure 3) as follows: 

Region 1 : For £ > A and © > B and ^co > C risk = 0 
Region 2: For £ < 0 risk=l 

and the interpolation between these regions, when neither of the above apply, is given by: 

Region 3: For C, > C/B and © < B, risk = 1 - ©/B 

Region 4: For 0 < £ < A and © > C/A risk = 1 - (JA 

Region 5 : For 0 < ^ < A and © < B and £,© < C risk = 1 - £,©/C 

This defines a linear interpolation between 0% risk and 1 00% risk. Defined in this way, risk is a 

continuous function of C, and ©. The five regions in the C-© plane defined above are depicted 
schematically in Figure 3, and a color plot of the risk function is shown in Figure 4. 



Figure 3. — A schematic of the risk interpolation. The blue line 
marks the edge of the Level 2 (“acceptable”) region in the C© 
plane. The numbers label different regions of the interpolation 
described in the text. 
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Figure 4. — Risk as a function of dutch roll damping ratio and natural frequency. 


2.4.2 Runway Incursion 

One way to potentially avoid disaster in a runway incursion is to reduce the takeoff distance, lifting 
the plane over the obstacle. The distance needed for takeoff can be calculated as a function of engine 
thrust as well as aircraft weight, ambient conditions, and other factors. In theory, if the distance and 
height of an obstacle on the runway is known (via a dedicated ranging sensor), the thrust needed to clear 
the obstacle can be computed. In reality, there will be uncertainty in the takeoff model and its parameters, 
so the probability of clearing the obstacle as a function of nominal thrust should be calculated. This gives 
the situational risk as a function of engine capability, which is what is needed to determine the optimal 
level of engine enhancement. 

The risk estimator also needs to be aware of the uncertainty of its takeoff model and its sensor data. 
For example, if the takeoff model calculates that the plane should clear the obstacle by fifteen feet, the 
risk estimator must know whether that represents relative safety or a dangerous risk, perhaps as a function 
of the variance of the estimate, in order to decide how much engine risk to take on. A straightforward way 
to do this would be to experimentally determine the uncertainty in each input to the takeoff model, and in 
the model itself. Then, add up all the uncertainties statistically to determine the range of likely takeoff 
trajectories and thus determine the probability that the plane will clear the obstacle. 

As an example of this idea, Figure 5 and Figure 6 show the output of a simple randomized takeoff 
simulation. Many trials were simulated in which engine thrust and takeoff weight were random variables 
with normal distributions, each with a standard deviation of 1 %. An obstacle was located a certain 
distance down the runway, and the takeoff trajectory had to achieve a certain height at that distance in 
order to clear the obstacle. In this scenario, 3.2% of the takeoff trajectories would have failed to clear the 
obstacle as shown in Figure 6. This shows how risk can arise from uncertainties in model inputs. 
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Figure 6. — Histogram of the vertical clearance of the plane over an 
obstacle in 100,000 runs of a randomized takeoff simulation. Negative 
clearances, highlighted in red, represent trajectories that collide with 
the obstacle and constitute 3.2% of the overall distribution. 

3.0 Proof of Concept 

These examples of situational risk models were incorporated into a simulation of the proposed 
interaction between the flight controller and the propulsion controller. The Commercial Modular Aero- 
Propulsion System Simulation 40k (C-MAPSS40k) 16 turbofan engine simulation was used to represent 
the propulsion system. It was integrated with an estimator of the risk of implementing different levels of 
enhanced engine operation. 17 This setup was used to evaluate the vertical tail damage and runway 
incursion scenarios within the proposed Risk Management Architecture. 
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3.1 Vertical Tail Damage 

In our proof of concept, a lateral-directional flight dynamics simulation, which takes into account 
vertical tail damage and the response characteristics of the engine, computes the aircraft dynamic 
response. The output of the simulations is the closed-loop dutch roll natural frequency and damping ratio 
achievable with differential thrust, given the natural frequency and damping ratio of the engine. In this 
way, the flight controller can estimate situational risk as a function of the capability of the engine. A 
sample engine risk model relates engine response time to engine risk. A simple flight controller then takes 
vertical tail damage as an input and uses the situational risk and engine risk models to determine the 
optimal level of engine risk. Figure 7 and Figure 8 show the results of a simulation in which 45% of the 
tail’s effective area is missing. The selected engine response is an input to the lateral-directional flight 
dynamics model, and the outputs of this are used to compute the situational and total risks at each level of 
engine risk. In this example, the optimal level of engine risk is found to be 15%. 



Engine risk 


Figure 7. — The risk measurements used to determine the optimal 
level of engine enhancements in a simulation run. Situational risk 
and total risk are shown at five possible levels of engine risk. 
Total or overall risk is minimized at 15% engine risk. 



Dutch roll damping ratio 

Figure 8. — The markers show the improvement in flying qualities at five 
levels of engine risk (left to right, 0%, 5%, 10%, 15%, 25%). 
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3.2 Runway Incursion 

The runway incursion risk estimation was integrated with the C-MAPSS40k overthrust engine risk 
estimator to produce an example of a complete risk management system for runway incursion. A 
maximum thrust level can be determined for C-MAPSS40k for a given engine risk level and flight 
condition, shown in Figure 9. 17 Figure 10 shows the process of risk minimization for a takeoff situation in 
which overthrust can help lift the plane over an obstacle. Situational risk is calculated for a sample 
runway incursion situation as described above (see Figure 6). Again, we assumed a standard deviation of 
1% in both thrust and takeoff weight. For this particular situation, 15% engine risk is calculated to give a 
greater than 95% chance of clearing the obstacle (situational risk) and minimizes the overall risk to the 
plane, as shown in Figure 10. 



Figure 9. — Maximum thrust versus engine risk for the C- 
MAPSS40k engine simulation at sea level, on a hot 
day, at a Mach number of 0.17. 


cr 

n 


on 



Engine Risk 


Figure 10. — Situational risk and total risk at five levels of 
engine risk. Situational risk is calculated as in Figure 6. 
Total risk is minimized at 15% engine risk. 
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4.0 Challenges in Risk Management 

The situations described in the examples are extremely uncommon, and even when they do occur the 
circumstances are often unique. Thus the approaches taken in this research to mitigate these emergencies 
must be broad enough to encompass a variety of similar cases. This leads to the problem of properly 
determining the situational risk in a way that is valid and meaningful, as well as general enough to capture 
the range of events that would fall into the categories addressed by these propulsion control 
enhancements. These are whole areas of research themselves, and our work can only acknowledge the 
shortcomings of the available data for these purposes. 

Preliminary risk estimators are presented here to illustrate the idea of the risk management system and 
are intended only as examples. More work is needed to improve the accuracy of automated risk 
estimation. For instance, military flying qualities specifications and the studies on which they are based 
are not ideal as a source for estimating the risk of landing with a given combination of flying qualities 
parameters; here they serve only as a basis for a first approximation. The purpose of these studies was 
twofold: to find the combinations that give the best flying qualities and to determine the boundaries of 
what qualities are acceptable for routine flights. Previous studies have not spent much time investigating 
the regions of parameter space in which failure to land safely is at all probable. In contrast we consider 
more extreme and desperate situations, with a view to obtaining an estimate of the chance that a plane 
will be landed safely when the flying qualities are severely degraded from what is normally acceptable. In 
the absence of research dedicated to this topic, we have used the safety specifications determined from 
these studies to obtain an approximate boundary of the region of parameter space that carries very low 
risk. 

The feasibility of implementing a system like the one described here would be determined by the 
ability to build a risk estimator that is accurate and fast enough to make the right tradeoffs between engine 
risk and situational risk. Data for situational risk estimation from degraded flying qualities could likely be 
collected in simulator studies. Similar kinds of studies have been conducted in investigations of throttles- 
only control and as part of NASA’s Propulsion Controlled Aircraft investigation, in which pilots 
attempted landings in simulation after all flight control surfaces were disabled and only the throttles could 
be used to steer . 6 ’ 18,19 To collect data for use in a risk estimator, pilots might attempt simulated landings 
with various settings for flying qualities parameters, such as dutch roll frequency and damping, and 
observe the frequency of survivable landings. This would give more relevant data on which to base a risk 
estimator. It would also suggest a shape for the interpolation between the safe and unsafe regions of the 
flying qualities parameter space that might be quite different from our simple linear interpolation. 

One difficult issue is that situational risk depends on many factors. For example, the risk from 
degraded flying qualities varies a great deal depending on the level of turbulence the plane experiences. In 
calm air, the aircraft may remain controllable even if stability parameters are severely degraded, because 
the oscillatory modes, though weakly damped, will not be excited. Other important factors include the 
experience of the pilots and the availability of automatic aids like instrument landing systems. 

A full risk management system will require sophisticated integration of many kinds of data. It might 
also need to interact with the crew in order to incorporate human judgments into the assessment of risk. 
For example, an experienced pilot may be more confident in his ability to land the plane in turbulence. To 
a significant extent, then, the risk management system should be under pilot control. Flowever, in 
situations where dangerous flying qualities could be improved with minimal engine risk, the system could 
automatically modify them without explicit pilot action; this would clearly require a highly reliable and 
intelligent risk estimation system. 

Situational risk assessment depends upon having an accurate and reliable model of the aircraft 
dynamics as they depend on engine capabilities. For simplicity, we have investigated only a rudimentary 
model of tail damage that disables the rudder. A full risk management system will require more general 
dynamics and risk models. Possibly, a sophisticated fault detection and diagnosis system would be able to 
assess damage to the plane and feed into an adaptive flight dynamics model that would be able to assess 
the risk of landing the damaged plane as a function of the capabilities of the engine. 
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5.0 Conclusions 


The proposed risk management architecture is a simple and general way of automatically managing 
risk for engine enhancement in an emergency. The complexity and intelligence of the system reside in the 
proposed risk estimators for engine and situational risk, which require detailed knowledge about the 
aircraft and its dynamics as well as important situational influences and how these affect risk. The 
proposed situational risk estimators for the two emergency conditions discussed suggest possible ways of 
implementing this intelligence. However, the situational risk functions themselves are very difficult to 
formulate and validate because each event is unique and the probability of any such event occurring is 
extremely small. It was proposed that simulation studies could be used to quantify risk for particular 
scenarios, but even that approach limits the validity to the cases evaluated. Additionally, the level of 
uncertainty in the pilot’s awareness of the situation, variation in pilot skill, and weather conditions, 
among other things, make the situational risk extremely hard to quantify. Other uncertainties such as 
aircraft weight, sensor measurement error, and thrust variations, can be modeled more easily, but 
determining realistic values may be a challenge. Finally, while the engine will have a predictable safe 
operating life under normal use, enhanced operation will increase risk of failure, creating uncertainty that 
may be difficult to validate. Building successful risk management systems will require dedicated studies 
to gather important data for use in risk models. 

References 

1 National Transportation Safety Board, “Aircraft Accident Report: American Airlines, Inc. McDonnell 
Douglas DC-10-10, N103AA. Near Windsor, Ontario, Canada, June 12, 1972,” PB— 219 370, 1973. 

2 Faith, N., “Black Box: Why Air Safety Is No Accident,” Zenith Press, 1997, pp. 157-158. 

3 Job, M., and Swift, S., “JAL123, JAL123 ... uncontrollable,” Flight Safety Australia, July-August 2005, 
Vol. 9, No. 4, pp. 28-33. 

4 National Transportation Safety Board, “Aircraft Accident Report, United Airlines Flight 232, 
McDonnell Douglas DC- 1040, Sioux Gateway Airport, Sioux City, Iowa, July 19, 1989,” PBSO-9 10406, 
NTSB/AARSO/06, 1990. 

5 Burcham, F.W., Jr., Fullerton, C.G., and Maine, T.A., “Manual Manipulation of Engine Throttles for 
Emergency Flight Control,” NASA/TM-2004-2 12045, January 2004. 

6 Burcham, F. W., Jr., and Fullerton, C. G., “Controlling Crippled Aircraft — With Throttles,” NASA TM- 
104238, 1991. 

7 National Transportation Safety Board, “Aircraft Accident Report: Attempted Takeoff From Wrong 
Runway Comair Flight 5191 Bombardier CL-600-2B19, N431CA Lexington, Kentucky August 27, 
2006,” NTSB/AAR-07/05, PB2007-9 10406, 2007. 

8 National Transportation Safety Board, “Runway Collision of USAIR Flight 1493, Boeing 737 and 
Skywest Flight 5569 Fairchild Metroliner, Los Angeles, California, February 1, 1991,” PB9 1-9 10409, 
NTSB/AAR-91-08, 1991. 

9 Guo, T.-H, Litt, J.S., "Risk Management for Intelligent Fast Engine Response Control," AIAA-2009- 
1873, AIAA Infotech@Aerospace Conference, Seattle, WA, April 6-9, 2009. 

10 Litt, J.S., Shaip, L.M., and Guo, T.-H., “A Risk Assessment Architecture for Enhanced Engine 
Operation,” AIAA 2010-3469, AIAA Infotech@Aerospace 2010, Atlanta, Georgia, April 20-22, 2010. 

11 Cooper, G.E. and Harper, R.P., “The Use of Pilot Rating in the Evaluation of Aircraft Handling 
Qualities,” NASA TN D-5 153, April 1969. 

12 Hall, G. W. and Boothe, E. M, “An In-Flight Investigation of Lateral-Directional Dynamics for the 
Landing Approach,” FAA-RD-71-26, October 1971. 

13 Ellis, D. R,. and Seckel, E., “Flying Qualities of Small General Aviation Airplanes. Part I. The 
Influence of Dutch-roll Frequency, Dutch-roll Damping, and Dihedral Effect,” FAA DS-69-8 June 1969. 


NASA/TM— 2011-217143 


12 



14 Woodcock, R. J. and Drake, D. E., “Estimation of Flying Qualities of Piloted Airplanes,” AFFDL-TR- 
65-218, April 1966. 

L '' Department of Defense, “M1L-E1DBK-1797 - Flying Qualities of Piloted Aircraft,” 19 December 1997. 

16 May, R. D., Csank, J., Lavelle, T. M., Litt, J. S., and Guo, T.-H, “A High-Fidelity Simulation of a 
Generic Commercial Aircraft Engine and Controller,” A1AA-20 10-6630, 46th ALAA/ASME/SAE/ASEE 
Joint Propulsion Conference and Exhibit, Nashville, TN, July 25-28, 2010. 

17 Csank, J., Chin, J. C., May, R. D., Litt, J. S., and Guo, T.-H., “Implementation of Enhanced Propulsion 
Control Modes for Emergency Flight Operation,” A1AA 2011-1590, A1AA lnfotech@Aerospace 2011 
Conference, St. Louis, MO, March 29-31, 2011. 

18 Burcham, F. Jr., Maine, T., and Wolf, T., “Flight Testing and Simulation of an F-15 Airplane Using 
Throttles for Flight Control,” NASA TM-1 04255, August 1 992. 

19 Burcham, F. Jr., Maine, T., Fullerton, C.G., and Webb, L., “Development and Flight Evaluation of an 
Emergency Digital Flight Control System Using Only Engine Thrust on an F-15 Airplane,” NASA 
Technical Paper 3627, September 1996. 


NASA/TM— 2011-217143 


13 



REPORT DOCUMENTATION PAGE 

Form Approved 
OMB No. 0704-0188 

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the 
data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this 
burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. 
Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB 
control number. 

PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 

1 . REPORT DATE (DD-MM-YYYY) 2. REPORT TYPE 

0 1 - 12-20 1 1 Technical Memorandum 

3. DATES COVERED (From - To) 

4. TITLE AND SUBTITLE 

A Risk Management Architecture for Emergency Integrated Aircraft Control 

5a. CONTRACT NUMBER 

5b. GRANT NUMBER 

5c. PROGRAM ELEMENT NUMBER 

6. AUTHOR(S) 

McGlynn, Gregory, E.; Litt, Jonathan, S.; Lemon, Kimberly, A.; Csank, Jeffrey, T. 

5d. PROJECT NUMBER 

5e. TASK NUMBER 

5f. WORK UNIT NUMBER 

WBS 457280.02.07.03.03 

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 

National Aeronautics and Space Administration 
John H. Glenn Research Center at Lewis Field 
Cleveland, Ohio 44135-3191 

8. PERFORMING ORGANIZATION 
REPORT NUMBER 

E- 17880 

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 

National Aeronautics and Space Administration 
Washington, DC 20546-0001 

10. SPONSORING/MONITOR'S 
ACRONYM(S) 

NASA 

11. SPONSORING/MONITORING 
REPORT NUMBER 

NASA/TM-20 11-217143 

12. DISTRIBUTION/AVAILABILITY STATEMENT 

Unclassified-Unlimited 

Subject Categories: 7 and 63 

Available electronically at http://www.sti.nasa.gov 

This publication is available from the NASA Center for AeroSpace Information, 443-757-5802 

13. SUPPLEMENTARY NOTES 

14. ABSTRACT 

Enhanced engine operation— operation that is beyond normal limits— has the potential to improve the adaptability and safety of aircraft in 
emergency situations. Intelligent use of enhanced engine operation to improve the handling qualities of the aircraft requires sophisticated 
risk estimation techniques and a risk management system that spans the flight and propulsion controllers. In this paper, an architecture that 
weighs the risks of the emergency and of possible engine performance enhancements to reduce overall risk to the aircraft is described. Two 
examples of emergency situations are presented to demonstrate the interaction between the flight and propulsion controllers to facilitate the 
enhanced operation. 

15. SUBJECT TERMS 


Engine control; Thrust control 


16. SECURITY CLASSIFICATION OF: 


17. LIMITATION OF 

18. NUMBER 

19a. NAME OF RESPONSIBLE PERSON 




ABSTRACT 

OF 

ST1 Help Desk (email:help@sti. nasa.gov) 

a. REPORT 

u 

b. ABSTRACT 

u 

c. THIS 
PAGE 

u 

uu 

PAGES 

20 

19b. TELEPHONE NUMBER (include area code) 

443-757-5802 


Standard Form 298 (Rev. 8-98) 
Prescribed by ANSI Std. Z39-18 




































